ISO/IEC 27001

ISO/IEC 27001:2022 is the international standard for an information security management system. Two things make it different from the EU regimes this help centre otherwise covers: it is certifiable by an accredited body, and it is selective — you choose which controls apply and record why.

The two halves

• Clauses 4–10 are the management system: context, leadership, planning, support, operation, performance evaluation, improvement. This is the half auditors spend most of their time on and the half organizations under-prepare, because it is about process rather than technology.
• Annex A is 93 controls in four themes — Organizational (37), People (8), Physical (14) and Technological (34). The 2022 revision restructured the 2013 edition’s fourteen clauses into these four and added eleven new controls, threat intelligence and cloud-service security among them.

Adopting the framework in Vendorica scaffolds a control for each Annex A control in scope, and the citation tree follows the standard’s own numbering (A.5.19, A.8.16) so an auditor reading your evidence sees the reference they expect.

The Statement of Applicability

The SoA is the artefact that makes ISO 27001 selective: for every Annex A control, you state whether it applies, and if not, why not. An auditor reads it early and uses it to plan.

Vendorica’s shape for this is the control register plus its status vocabulary — see Working with controls. A control that genuinely does not apply is deactivated rather than left permanently at needs evidence, and deactivating asks for a reason, which is the justification the SoA needs.

Do not deactivate a control to clear a red status

It is the single most tempting shortcut in the product and it produces an SoA that says you decided physical security is out of scope. Deactivation is a statement to your certification body. If a control is unstaffed rather than inapplicable, leave it red and raise a finding — a red control with an owner and a date is a programme in progress; a deactivated one is a claim.

Certification, and what your auditor will ask for

A certification audit runs in two stages: Stage 1 reviews your documentation and readiness, Stage 2 tests whether the ISMS actually operates. Then surveillance audits annually and recertification every three years.

What Stage 2 asks for is what the product already holds:

• Policies approved and published, with review cycles that have actually run — see Policies.
• Evidence with effective dates, showing controls operating across the period rather than in the week before the audit — see Evidence.
• Internal audit and management review as their own records.
• Risk assessment and treatment, with a methodology you can state — see Scoring, treatment and appetite.
• Corrective actions from findings, closed with proof.

Run the engagement itself through Audits: the auditor gets their own scoped portal and an information-request list, and every document they open is recorded.

Why the second framework is cheaper

ISO 27001 is the framework most others cross-map to. If you adopted it first, a later SOC 2 or NIS2 adoption inherits most of its evidence through the crosswalk; if you are adopting it second, the same is true in reverse. One control, mapped to several citations, evidenced once — see Adopting a framework.

ISO 27001 and ISO 42001 are different standards

If AI systems are in scope for you, ISO/IEC 42001 is the AI management system standard and ships separately, alongside the AI system register. An ISMS does not cover it.